PCAP / PCAPNG Parser
Parse .pcap and .pcapng packet captures entirely in your browser. Decode Ethernet / IPv4 / IPv6 / TCP / UDP, get a per-packet list with timestamps and IPs, filter by protocol (TCP, UDP, HTTP, DNS), reassemble sessions, see a traffic-distribution chart, and export as CSV. Pure front-end parsing — your capture file never leaves the page.
Statistics
Upload a capture file to see statistics.
Filters
Sessions (reassembled, top 12 by packets)
Packets (showing first 300 of filtered)
Packets appear here.
How to use the PCAP / PCAPNG Parser
Upload a packet capture (.pcap or .pcapng — e.g. from Wireshark or tcpdump) and the tool decodes it locally, layer by layer, with no server round-trip. Your capture file never leaves the page.
What it decodes
- Formats — classic pcap (little / big endian, micro / nano seconds) and pcapng (SHB / IDB / EPB blocks).
- Link layer — Ethernet II (with VLAN tags) and raw IP captures.
- Network layer — IPv4 and IPv6 (source / destination / protocol).
- Transport — TCP and UDP (ports). ICMP, ARP and others are labelled by their protocol number.
- Application — HTTP (port 80/8080 or payload markers) and DNS (port 53) are recognised; TLS is flagged on port 443.
Analysis
- Statistics — total packets, per-protocol counts and a traffic-distribution chart.
- Sessions — flows are reassembled by the 5-tuple (protocol, src IP/port, dst IP/port), counting packets and bytes in each direction.
- Filter — by protocol, source / destination IP, or port (comma-separated). Export CSV downloads the filtered packets.
This parser focuses on common capture formats and the main TCP/IP layers. Heavily fragmentated packets or unusual link types (802.11, PPP) may be labelled as undecoded.